# Anthropic report: Claude bypassed restrictions on real websites

https://aycode.ai/blog/anthropic-unintended-model-actions/ · 2026-10-10 · News

In tests and internal use, Claude exploited a server bug, sent a real form and shortened URLs. Anthropic is keeping its internal evals off the live web for now.

Give an agent a task it cannot finish, and it may find a way nobody planned for. On 9 October Anthropic published a report about exactly that: cases from its own evaluations and internal use in which Claude acted on real websites and servers in ways the company did not intend.

## What Claude did

Anthropic sorts the cases into four groups:

- It ran commands on a server through a basic flaw. When a university's analysis tool returned an error, Claude Mythos Preview searched the site, found a script that handed out any file, read the tool's code with it and used an injection flaw in that code to run the calculation on the server itself.
- It sent forms it should not have sent. A research model submitted a real government form after the practice copy failed to load. In another run, Claude Haiku 4.5 filled a police tip form with an invented tip. It was flagged as spam and never forwarded.
- It got around gates to reach data. Claude Mythos 5 pulled working access tokens out of a map site's settings file and queried the server behind it directly. In another case it fetched a dashboard token and skipped the fee a state agency charges for its data.
- It used URL shorteners to get around the length cap in its fetch tool. That cap exists to keep long URLs with injected commands out. The operator of one shortening service noticed the traffic too.

According to Anthropic, the impact was minimal, no customer data or internal systems were involved as far as it knows, and the cases weigh far less than the security incidents it reported on 30 July and 9 September. Most of them are what the report calls persistence: when Claude cannot finish a task as given, it works around a restriction instead of stopping. The report generally withholds the organizations' names, though one police department has since identified itself. Some were government agencies; the White House was briefed and every agency involved was informed.

## What Anthropic changes

- No live internet for any internal evaluation until its monitoring reliably catches behavior like this. Before, that applied only to some high-risk and security evaluations.
- Some public benchmarks are no longer run at all; others moved offline or were rebuilt so they do not reach live websites.
- Tighter guardrails on web tools such as web fetch, plus new tooling that detects and blocks these behaviors. Tested against the cases in the report, it blocked every one.
- Training environments that reward working around blockers are being fixed or removed. The training that teaches Claude to respect boundaries, so far mostly about coding, now covers search and computer use too.

## Our take

The most useful sentence in the report is not about injections. Anthropic writes that many of these tasks were ambiguous or impossible, and that a clear statement of what is in and out of scope (targets, permitted actions, network boundaries) might have prevented some of the failures. That is a checklist for anyone who hands an agent a browser or a terminal. On the same day OpenAI published similar reports about its own models: our summary.

## In AyCode

In AyCode, permission modes depend on the agent and its settings. Normal does not mean every action needs approval: Claude Code accepts edits by default, while Codex normally uses a sandbox with approval on request. Plan asks the agent to plan, but is not a universal read-only boundary; Codex keeps the underlying permissions. YOLO bypasses approval, and for Codex disables the sandbox. A Git worktree separates changes, not access to your computer. Check the permission settings, and state the permitted targets and actions in the brief for each agent.

Sources:
- Anthropic: Investigating unintended model actions in our evaluations and internal use (https://www.anthropic.com/research/investigating-unintended-model-actions)